permissions first